Law enforcement sources tell CBS News that Ullah said the attack was for the Islamic State of Iraq and Syria, also known as ISIS. He is believed to have made the bomb himself with the intent of harming others.

Several people nearby suffered minor injuries and the suspect was seriously injured. No other threats were apparent, the mayor said.

"Thank God the perpetrator did not achieve his ultimate goals," de Blasio said.

Ullah is in police custody. Officials say he sustained burns to his abdomen and hands after the crude pipe bomb exploded. A photo confirmed by CBS News showed a bearded man crumpled on the ground with his shirt apparently blown off and black soot covering his bare midriff. A police officer is holding the man's hands behind his back.

Surveillance cameras captured the man walking casually through the crowded passageway when the bomb suddenly went off at 7:20 a.m. amid a plume of white smoke, which cleared to show the man sprawled on the ground and commuters fleeing in terror.

A law enforcement source tells CBS News' Jeff Pegues four Port Authority Police officers apprehended the suspect. When they encountered him, Ullah had a shrapnel wound and there was smoke around him and debris all over the floor, Pegues reports.

The source said as police approached, Ullah appeared to be reaching for a cellphone, and he had wires protruding from his jacket and his pants.

New York City Police Commissioner James O'Neill said the suspect "made statements" when he was taken into custody but wouldn't say whether he made reference to ISIS. Ullah has since been interviewed by investigators, CBS News' senior investigative producer Pat Milton reports.

The device was based on a pipe bomb and affixed to the suspect's body with a combination of velcro and zip ties, said John Miller,the deputy commissioner of intelligence and counter-terrorism for the NYPD. A federal law enforcement official told Pegues the device malfunctioned. The source says "it did not fully detonate which possibly caused the injury."

O'Neill said it wasn't clear whether the suspect detonated the device by accident or whether the location was intentional. Police and the Joint Terrorism Task Force were investigating how the device was made and where he got the bomb-making instructions, reports CBS New York.

Ullah apparently built the bomb with materials he acquired at his workplace, though it's not clear where he worked or where he assembled the device, a law enforcement official told Milton.

The suspect also had another device on him, sources tell CBS News.

New York Governor Andrew Cuomo says the suspect may have crafted the device using online instructions. Cuomo told cable news channel NY1 that officials "have reason to believe that this person went to the internet and found out how to make a homemade bomb."

This photo confirmed by CBS News shows a suspect after his explosive device detonated in an underground passageway near the Port Authority Bus Terminal in New York City on Mon., Dec. 11, 2017.

Authorities are investigating the incident as a possible "lone wolf" attack based on the rudimentary construction of the device, reports CBS New York. Investigators are trying to determine whether Ullah may have been in contact with any known extremist individuals or if anyone helped him in the plot, Milton reports.

The suspect is from Bangladesh, CBS News has learned. Ullah entered the U.S. with his parents and three to four siblings in February 2011 on an immigrant visa, sources tell CBS News. He obtained a green card and became a permanent U.S. resident.

"DHS can confirm that the suspect was admitted to the United States after presenting a passport displaying an F43 family immigrant visa in 2011," said Department of Homeland Security acting Press Secretary Tyler Houlton in an email to CBS News. "The suspect is a lawful permanent resident from Bangladesh who benefited from extended family chain migration."

48 Hours' Murray Weiss reports Ullah has an address in Brooklyn. Police spoke with Ullah's family in the borough's Flatlands section, CBS New York's Marcia Kramer reported. Ullah lived with his father, mother and brother in a residential area with a large Bangladeshi community, neighbors told the Associated Press. The home was just off a shopping strip - a red two-story brick building.

Investigators were searching his apartment, interviewing witnesses and relatives and looking for surveillance footage that may show his movements in the moments before the attack.

Alan Butrico owns the house next door and a locksmith business two doors down.

"It's very weird," he said. "You never know who your neighbors are."

The Bangladesh Embassy in Washington condemned the attack. The deputy chief of mission, Mahbub Hassan Saleh, said the embassy had not received any information from authorities about the suspect.

Just over a year after arriving in the U.S., in March 2012, Ullah secured a livery license, the New York City Taxi & Limousine Commission tells CBS News' Graham Kates. That license, which was not for a New York City cab, but instead for a so-called "for-hire" vehicle, lapsed in March 2015.

Ullah apparently traveled overseas to Bangladesh in September and returned in October, a law enforcement source tells Milton. He also previously traveled to the United Arab Emirates, Milton reports.

Ullah had no criminal history prior to Monday's attack, Weiss reports. Charges were expected to be filed against him in federal court in New York as early as Tuesday, Milton reports.